- Being located in EU.

- Or in case where you aren't located in EU, providing services specifically to EU residents, which can be hinted by having a language choice mostly spoken in EU countries, allowing EU currencies (Euro, British pound and so on) or specifically mentioning supporting EU, for instance by saying that your website can deliver packages to European Union.

Facebook for instance has offices in EU, which makes it clear that they are under GDPR, but even if they didn't, they do provide Facebook in EU languages.

English is an EU language; the UK is still in the EU, and Ireland is not expected to leave.

Malta has English as official language, just so people remember.

So, for instance, you can pretend that you're not operating in France if your website is in English and you only accept payments in USD?

I would argue that this is a bad definition because what you described is just operating in a jurisdiction but without localization.

I prefer the definition where you're making money(directly or indirectly) by providing services in a jurisdiction.

An example would be collecting French users data and then selling it to ad agencies(or being acquired by Google?).

Yes. That's how the current GDPR law works. And it seems reasonable to me.

Accepting payments in USD is a pretty clear signal that a website mostly cares about US users, and if someone else uses the website, oh well, it happened, doesn't really change anything under GDPR.

(although you probably could have French support anyway, just expand the website to Canada as well ;), of course it isn't the same French as in France, but it's still French somewhat, EU currencies are trickier however)

French is widely spoken in Africa as well.